Possible Patch Problems - MS05-051

FYI…

- http://isc.sans.org/diary.php?storyid=765
Last Updated: 2005-10-14 17:58:25 UTC
"We have had a report of problems with MS05-051. Here is what we have received. If anyone else is experiencing problems, please let us know. A number of people have reported weird problems with one of the MS patches released yesterday, specifically MS05-051 Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution (902400).

Symptoms include, but are not limited to:
- Inability to visit Windows Update
- Inablility to use the Search tool off the Start Menu
- blank screen (no icons) upon login
- Symantec LiveUpdate stops working
- SpySweeper stops working
- problems with Office apps
- VirtualPC becomes extremely sluggish

Lee said he had spoken to a Microsoft engineer about this. From what he could tell: "This issue is only affecting people with very specific NTFS permissions. If the C:\Winnt\Registration\ folder is locked down and cannot be written to by COM+ you will have errors similar to those listed in your alert. All of those tasks use COM+ in one way or another." Uninstalling patch 902400 seems to do the trick for most folks. You may need to check the "Show Updates" box under Add/Remove Programs to see the hotfixes…"

FYI…

Microsoft Security Bulletin MS05-051
- http://www.microsoft.com/technet/security/…n/ms05-051.mspx
"…Revisions:
• V1.0 (October 11, 2005): Bulletin published.
• V1.1 (October 14, 2005): Bulletin revised to advise customers of the availability of Microsoft Knowledge Base Article 909444 which describes a potential issue which may be encountered after installing this update."
- http://support.microsoft.com/kb/909444
"Systems that have changed the default Access Control List permissions on the %windir%\registration directory may experience various problems after you install the Microsoft Security Bulletin MS05-051 for COM+ and MS DTC…
Article ID : 909444
Last Review : October 15, 2005
Revision : 4.0
…SYMPTOMS
On a computer that is running Microsoft Windows XP, Microsoft Windows 2000 Server, or Windows Server 2003, one or more problems may occur after you install the critical update that is discussed in Microsoft Security Bulletin MS05-051. These problems include the following:
• The Windows Installer service may not start.
• The Windows Firewall Service may not start.
• The Network Connections folder is empty.
• The Windows Update Web site may incorrectly recommend that you change the Userdata persistence setting in Microsoft Internet Explorer.
• Active Server Pages (ASP) pages that are running on Microsoft Internet Information Services (IIS) return an “HTTP 500 – Internal Server Error” error message.
• The Microsoft COM+ EventSystem service will not start.
• COM+ applications will not start.
• The computers node in the Microsoft Component Services Microsoft Management Console (MMC) tree will not expand.
• Authenticated users cannot log on, and a blank screen appears after the users apply the October Security Updates…"

FYI…

- http://isc.sans.org/diary.php?storyid=765
Last Updated: 2005-10-15 12:26:47
"…Uninstalling patch 902400 seems to do the trick for most folks. You may need to check the "Show Updates" box under Add/Remove Programs to see the hotfixes. The better answer is calling Microsoft directly; this should be a free call if the issue is problems with a patch. The US number is [removed]. Outside of the US, see http://support.microsoft.com/common/intern…l.aspx?rdpath=4 …"